Linuxdoc Linux Questions
Click here to ask our community of linux experts!
Custom Search
Next Previous Contents

5. Unmounting the file system

Regardless of which method you choose, the first step is to unmount the file system containing the deleted files. I strongly discourage any urges you may have to mess around on a mounted file system. This step should be performed as soon as possible after you realise that the files have been deleted; the sooner you can unmount, the smaller the chance that your data will be overwritten.

The simplest method is as follows: assuming the deleted files were in the /usr file system, say:

# umount /usr

You may, however, want to keep some things in /usr available. So remount it read-only:

# mount -o ro,remount /usr

If the deleted files were on the root partition, you'll need to add a -n option to prevent mount from trying to write to /etc/mtab:

# mount -n -o ro,remount /

Regardless of all this, it is possible that there will be another process using that file system (which will cause the unmount to fail with an error such as `Resource busy'). There is a program which will send a signal to any process using a given file or mount point: fuser. Try this for the /usr partition:

# fuser -v -m /usr

This lists the processes involved. Assuming none of them are vital, you can say

# fuser -k -v -m /usr

to send each process a SIGKILL (which is guaranteed to kill it), or for example,

# fuser -k -TERM -v -m /usr

to give each one a SIGTERM (which will normally make the process exit cleanly).

Next Previous Contents